An estimated 72,000 people entered Ceuta from Morocco on July 30 and 31, in a movement that unfolded over roughly 48 hours. A new investigation by Golden Owl, a startup linked to the University of Alicante, describes it as a deliberately organized operation rather than a spontaneous crossing. Based on monitoring Moroccan social media activity, the study reports a recruiter network using coded language and security measures to conceal participants’ identities. The Spanish central government’s estimate was cited in subsequent coverage of border-control discussions between Spain and Italy. The figure measures the scale of the crossing, while the investigation’s account of recruitment describes the network it identified.
Researchers identified a three-layer structure behind the operation. at its core was a closed coordination group that used private messaging to set meeting arrangements and crossing tactics. A public-facing layer on Instagram, including groups and pages with more than a million declared members, circulated information and encouraged candidates. The third layer consisted of micro-recruiters who assembled smaller cells and communicated through private channels. To avoid detection, organizers altered keywords and punctuated messages to obscure them; direct links were kept out of public posts.
The study describes recruitment as selective, with quotas for individual cells, rather than a single open call. It says organizers used one-time accounts and cross-border phone lines, while the campaign operated without a single leader. It relied on shared branding and slogans, with coded vocabulary rotated over time. Those findings depict a decentralized structure, but the government’s estimate of 72,000 crossings does not itself establish that every arrival was directed by one organization.
The scale was far above the closest major precedent: the May 17 and 18, 2021, crisis, when estimates put arrivals at about 8,000-10,000 people in less than two days. More than 1,500 minors were reported among those who crossed by swimming or over border barriers. Spain’s Interior Ministry said roughly half of the arrivals were returned to Morocco; Amnesty International estimated that about 5,000 people were summarily returned and raised concerns about access to asylum procedures. Spanish authorities maintained that established procedures had been followed. The episode came amid a severe diplomatic dispute between Madrid and Rabat, following the hospitalization in Spain of Polisario Front leader Brahim Ghali. It was followed by Foreign Minister Arancha González Laya’s departure from office.
European border-rights analysis also described the July movement as more than 70,000 arrivals within 48 hours. The European Union Agency for Fundamental Rights said it “put the balance between protecting fundamental rights and safeguarding the EU’s external borders to the test,” as reported by Politico Europe. The scale made the episode a major test of border management and a humanitarian challenge.
Economic incentives were central to the investigation’s account. It says public-facing groups attracted advertising revenue while a paid layer functioned as a smuggling market. The same groups allegedly advertised commercial sex and missing-person cases. They also offered paid transport for young people from cities such as Casablanca and Fez to Ceuta. The investigation identified a small group of administrators and recruiters, including a man from Casablanca living in Istanbul who provided a Turkish WhatsApp* (принадлежит Metа, которая признана экстремистской организацией и запрещена в РФ) contact, and another person based in Rome who managed what it described as the largest network node.
Investigators also reported the use of Algerian-origin assets, suggesting that a Moroccan-led operation drew on resources acquired or repurposed from elsewhere. After the July surge, police pressure led to the closure of five active recruitment groups that together had more than 200,000 members, information from the study. The network then shifted to general-interest spaces, including a Tangier job board and groups advertising European work contracts. Without migration-specific terms, these forums could be harder to distinguish from ordinary recruitment channels. The study says they attracted unemployed young people aged 18 to 25.
Recent monitoring cited by the investigators indicates that the network has become less visible but remains active. Some groups are reportedly directing candidates toward Melilla and advising arrivals in Nador to ignore security forces. The study characterizes this as a shift toward evasion and recommends extending monitoring to Melilla and Algerian departure ports. It also argues that the network’s organizational layer did not depend solely on Instagram.
After the July crossings, Spain introduced measures to manage the population remaining in Ceuta, while many entrants returned to Morocco. Interior Minister Fernando Grande-Marlaska later said that approximately 12,000 people had voluntarily returned since mid-August. Migrants and minors who remained faced difficult conditions, with consequences extending beyond the two-day surge. For more on the political and security context, see this analysis of Ceuta’s situation and EU debates: how Ceuta's security challenges have shaped European discussions.
Ceuta and Melilla, Spain’s two North African enclaves, have long been focal points for migration from Morocco and sub-Saharan Africa. The May 2021 crisis showed how sudden arrivals can intersect with diplomatic tensions and border enforcement, alongside disputes over individual screening and child protection, including non-refoulement. The Golden Owl study argues that recruiters’ use of legitimate social-media spaces complicates enforcement and points to language and behavioral analysis as tools for identifying changing patterns.
